Instructions on how to generate CSR about go-attestation HOT 2 CLOSED

Issuing certificates doesn't necessarily need to use PKCS #10 CSR structs, that's just one way for a client to say "here's a public key and some requested DNS names, please issue a certificate". Either way the CA needs to use other information to verify the client isn't lying and actually control the DNS names/key.

I wrote a bunch about attestation and that kind of thing here: https://ericchiang.github.io/post/tpm-keys/

If the CA already knows a client has possession of a private key, then it largely can just issue it a certificate. That could be a CSR struct, but it also could be just a regular REST or gRPC endpoint (e.g. look at the ACME protocol).

from go-attestation.

Thanks for clarification, @ericchiang! Will look into it

from go-attestation.